Zero-trust security model

What is a zero-trust approach?

A standard network security posture is focused on stopping threats that come from outside the network perimeter, but can leave data vulnerable to theft inside the network. This approach utilizes firewalls, VPNs, access controls, IDS, IPS, SIEMs, and email gateways with security on the perimeter that cyber criminals now know how to breach. This means someone with the correct credentials could be admitted to any network’s sites, apps, or devices. With zero-trust security, no one is trusted by default from inside or outside the network. Zero trust operates from the start by requiring verification from every user trying to gain access to resources, thereby authenticating users and regulating access to systems, networks, and data. This process involves validating user identities, associated access rights to a particular system, and enables organizations to manage the digital identities of users ensuring the appropriate access. To strengthen authentication, zero trust also uses several layers of advanced access control for access to network devices and the servers that support resources. This approach also enables the ability to track user activities, create reports on those activities, and enforce policies to ensure compliance.

The principles of zero-trust architecture as established by the National Institute of Standards & Technology (NIST) are:

1. All data sources and computing services are considered resources.
2. All communication is secure regardless of network location; network location does not imply trust.
3. Access to individual enterprise resources is granted on a per-connection basis; trust in the requester is evaluated before the access is granted.
4. Access to resources is determined by policy, including the observable state of user identity and the requesting system, and may include other behavioral attributes.
5. The enterprise ensures all owned and associated systems are in the most secure state possible and monitors systems to ensure that they remain in the most secure state possible.
6. User authentication is dynamic and strictly enforced before access is allowed; this is a constant cycle of access, scanning and assessing threats, adapting, and continually authenticating.

What are the advantages of zero-trust security?

Reduce risk
Reduce risks from constant threats with security-first design principles. Use technologies such as built-in tenant isolation and least privilege access also helping with compliance and privacy regulations. With well-managed identities, organizations enable greater control over user access, which translates to reduced risks of internal and external breaches.

Control access
A zero-trust security approach involves capturing user information, managing user identities, and orchestrating access privileges to help with regulating access to systems or networks for individual users within an organization.

Enhance organizations’ security posture

• Data exposure from misuse of access/ permission controls
• Data loss from the use of unsanctioned cloud services
• Lack of visibility into the movement of data between network perimeter and cloud services
• Users sharing sensitive data with an external third-party user via a cloud service
• Data exposure from remote users and personal devices
• Malicious insider activities, including former employees with active accounts/ permissions
• Data loss from the improper use of approved cloud services
• Non encrypted data
• An attacker masquerading as an employee via stolen credentials
• Misconfigured object storage accounts

 

Sharpen competitive edge

Organizations that adjust from a standard perimeter security approach to a zero-trust model take advantage of automation, security, and governance, which enhances their overall competitive advantage and business agility.

What are the best practices for zero-trust security?

Organizations that pursue a zero-trust security model must:

• Assess the current system to determine its present state and develop a remediation plan. An organization must first identify and prioritize its data in order to comprehend where to regulate access. A zero-trust security approach requires protecting data—which could be intellectual property, financial data, personal data about customers or staff, or (more likely) a combination of all three.
• Detect attempts to access data outside of policy, and identify anomalies in data access. Almost all activity is repetitive, so anomalies are frequently a leading-edge indicator of attempted data theft. Altering to a zero-trust model requires the capturing of user information, managing user identities, and organizing access privileges.
• Prevent access to data. Without automated monitoring of resources and activity, organizations become vulnerable to compromised users and data breaches. Zero trust enables greater visibility into an organization’s users and activity.

An effective zero-trust security model will deliver:

1. Security-first design principles with built-in security to reduce risk.

        -  Isolated network virtualization
        -  Granular separation of duties
        -  Least privilege access

2. Automated security to reduce complexity and prevent human error.

        -  Automated threat mitigation and remediation

3. Continuous, always-on security for seamless protection.

        -  Default-enabled, ubiquitous encryption
        -  Continuous monitoring of user behaviors
        -  Context aware adaptive authentication